PT-2026-73057 · Siyuan · Siyuan
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.7.4
Description
A cross-site scripting issue exists in the
unicode2Emoji() function due to a failure to sanitize codepoint branch output. This allows attackers to create document icons containing hex-encoded markup. When processed by the renderer with Node integration enabled, this can lead to arbitrary code execution on the host system.Recommendations
Update to version 3.7.4 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Siyuan